Hi,

A few months ago I was running a web database using PHP3, MySQL and Apache on Red Hat 9.0 which was hacked and used to host a phishing scam.

I've now installed FC6. Do the installations of Apache, MySQL and PHP5 as they come with the distribution offer adequate security or are there steps that everyone should take?

I'm aware of the basic security considerations of running PHP scripts, such as not keeping modules in the httpdocs directory and not allowing unfiltered input to be used in SQL statements.

Graham

FC6 incorporates SELinux as well as a firewall, so has fairly strong protection against remote exploits. The last time I looked at Fedora (FC5) the greatest weakness was that it enables SSH automatically, with remote root access permitted.

Once you turn that off, the biggest issue will probably be minimizing the access that local PHP scripts have into the database, which you've already mentioned.

A few months ago I was running a web database using PHP3, MySQL and Apache on Red Hat 9.0 which was hacked and used to host a phishing scam.
Not to kick you in the back but there's more than enough risks there to keep anyone busy... RHL 9 was deprecated a long time ago (and you couldn't have updated it with Fedora Legacy since they're gone), PHP3 is deprecated as well IIRC, but more likely the problem has been with the PHP-based apps you ran.


Could check out the LQ FAQ: Security references, post #6 "Securing networked services " for more on the "AMP" part of LAMP. Once you have those locked down you're ready to fight your PHP-based apps. Some developers even force people to run unsafe setting because else it won't work... Eventually it's your choice to either go with that investing in reinforcing the rest or try to find a "less unsafe" alternative. If you have a spare box it would be a good thing to mimic your setup there, secure it and throw some OWASP/Metasploit/Nessus tests at the box. In short: no, there's no out-of-the-box secure setup.

Thanks guys.

hob, I'd noticed that I had root access using SSH as I've been using that on my LAN. I'll disallow root as a user. Otherwise I find your reply re-assuring.

unSpawn, in a way I'm glad to know that the platform I was running was so insecure - it offers an explanation as to why I was hacked that means it should be less likely now I've upgraded. It does make me look rather lapse putting such a server on the Internet, but at the time I thought the worst thing a hacker could do was steal your data and I was only running a test site - there was no real data on the server.

Thanks for the link to the post relating to AMP. I see there are even some checking tools referenced there.

When I write PHP scripts I try to write code that ideally work whatever the configuration or at least with the most common/default/secure configuration. It's a culture shock to me how much the environment affects the running of the scripts as I'm mostly a C programmer, used to a program doing what you program it to do.

Thanks again,

Graham